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Mr.  Chairman  and  Members  of  the  Subcommittee: 


I  am  pleased  to  be  here  today  to  discuss  the  results  of  our  review  of 
Medicaid  financial  management  by  the  Centers  for  Medicare  and  Medicaid 
Services  (CMS).  My  testimony  today  summarizes  our  report  to  the 
Subcommittee,  published  in  February  of  this  year,1  which  discusses  the 
need  to  improve  federal  oversight  of  state  Medicaid  financial  activities. 

As  you  know,  the  federal  government  and  the  states  share  responsibility 
for  the  fiscal  integrity  and  financial  management  of  the  jointly  funded 
Medicaid  program.  In  fiscal  year  2000,  the  Medicaid  program  served  about 
33.4  million  low-income  families  as  well  as  certain  elderly,  blind,  and 
disabled  persons  at  a  cost  of  $119  billion  to  the  federal  government  and 
$88  billion  to  the  states  for  program  payments  and  administrative 
expenses. 

States  are  the  first  line  of  defense  in  safeguarding  Medicaid  funds  through 
their  responsibilities  for  making  proper  payments  to  providers,  recovering 
misspent  funds,  and  accurately  reporting  costs  for  federal  reimbursement. 
At  the  federal  level,  CMS  is  responsible  for  overseeing  state  financial 
activities  and  ensuring  the  propriety  of  expenditures  reported  by  the  states 
for  federal  reimbursement. 

Audits  of  state  Medicaid  finances  conducted  annually  in  accordance  with 
the  Single  Audit  Act,  as  amended,  have  identified  millions  of  dollars  of 
questionable  or  unallowable  costs  incurred  by  state  Medicaid  agencies.  In 
addition,  annual  financial  statement  audits  required  under  the  Chief 
Financial  Officers  Act  of  1990,  as  expanded  by  the  Government 
Management  Reform  Act  of  1994,  have  identified  many  internal  control 
weaknesses  in  CMS  oversight  of  state  Medicaid  operations. 

In  light  of  these  findings,  you  asked  that  we  review  the  adequacy  of  CMS’s 
financial  oversight  process  for  Medicaid.  We  assessed  whether  (1)  CMS 
has  an  adequate  oversight  process  to  help  ensure  proper  Medicaid 
expenditures,  (2)  CMS  adequately  evaluates  and  monitors  its  oversight 
process,  making  adjustments  as  necessary,  and  (3)  the  current  CMS 


’tJ.S.  General  Accounting  Office,  Medicaid  Financial  Management:  Better  Oversight  of 
State  Claims  for  Federal  Reimbursement  Needed,  GAO-02-300  (Washington  D.C.:  Feb.  28, 
2002). 


Page  1 


GAO-02-706T  Medicaid  Financial  Management 


organizational  structure  for  financial  management  is  conducive  to 
directing  its  oversight  process  and  sustaining  future  improvements. 

To  evaluate  financial  oversight  and  monitoring  at  CMS,  along  with  the 
control  activities  used  to  help  ensure  the  propriety  of  Medicaid 
expenditures,  we  performed  work  at  CMS  headquarters  and  regional 
offices,  surveyed  regional  financial  management  staff  and  reviewed  CMS 
manuals  and  other  documentation  and  audit  reports.  To  determine 
whether  CMS’s  organizational  structure  for  financial  management  is 
conducive  to  effectively  directing  its  oversight  process  and  sustaining 
future  improvements,  we  interviewed  directors,  managers  responsible  for 
financial  management  at  headquarters,  and  managers  in  five  regions.  We 
compared  information  we  gathered  about  organizational  structure, 
communications,  and  improvement  initiatives  with  the  Comptroller 
General's  Standa  rds  for  Internal  Control  in  the  Federal  Government.  We 
performed  our  work  from  October  2000  through  September  2001  in 
accordance  with  generally  accepted  government  auditing  standards. 

As  discussed  in  our  February  2002  report,  we  found  that  CMS  has  financial 
oversight  weaknesses  that  leave  the  Medicaid  program  vulnerable  to 
improper  payments.  The  Comptroller  General’s  Standards  for  Internal 
Control  in  the  Federal  Government  requires  that  agency  managers 
perform  risk  assessments,  act  to  mitigate  identified  risks,  and  then 
monitor  the  effectiveness  of  those  actions.  In  addition,  the  standards 
provide  that  agencies  should  ensure  that  the  organizational  structure  is 
designed  so  that  authority  and  responsibility  for  internal  controls  are 
clear.  CMS  oversight  had  weaknesses  in  each  of  these  four  areas,  which  I 
will  discuss  in  turn. 


CMS  Had  Not 
Implemented  a  Risk- 
Based  Approach  in 
Reviewing 
Expenditures 


Our  review  found  that  CMS  had  only  recently  begun  to  assess  areas  at 
greatest  risk  for  improper  payments.  As  a  result,  controls  were  not  in  place 
that  focused  on  the  highest  risk  areas  and  resources  had  not  yet  been 
deployed  to  areas  of  greatest  risk.  The  Comptroller  General’s  Standards 
for  Internal  Control  in  the  Federal  Government  requires  that  agency 
managers  perform  risk  assessments  and  then  act  to  mitigate  identified 
risks  that  could  impede  achievement  of  agency  objectives. 


2U.S.  General  Accounting  Office,  Standards  for  Internal  Control  in  the  Federal 
Government,  GAO/AIMD-OO-21.3.1  (Washington  D.C.:  Nov.  1999). 
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Since  1998,  financial  auditors  responsible  for  the  annual  financial 
statement  audit  of  Medicaid  expenditures  have  noted  that  CMS  failed  to 
institute  an  oversight  process  that  effectively  reduced  the  risk  of 
inappropriate  Medicaid  claims  and  payments.3  Financial  auditors  identified 
internal  control  weaknesses  that  increased  the  risk  of  improper  payments, 
including  a  significant  reduction  in  the  level  of  detailed  analysis  performed 
by  regional  financial  analysts  in  reviewing  state  Medicaid  expenses; 
minimal  review  of  state  Medicaid  financial  information  systems;  and  lack 
of  a  methodology  for  estimating  the  range  of  Medicaid  improper  payments 
on  a  national  level.  The  auditors  recommended  that  CMS  implement  a  risk- 
based  approach  for  overseeing  state  internal  control  processes  and 
reviewing  Medicaid  expenditures. 

Regarding  the  auditor’s  findings  and  recommendations,  CMS  officials 
attributed  most  of  the  weaknesses  in  its  oversight  to  reductions  in  staff  at 
the  same  time  Medicaid  expenditures  and  oversight  responsibilities 
increased.  CMS  data  show  a  32  percent  drop  in  regional  financial 
management  staff  from  95  full-time  equivalent  positions  in  FY  1992  to 
approximately  65  in  FY  2000.  At  the  same  time,  federal  Medicaid 
expenditures  increased  74  percent  from  $69  billion  to  $120  billion.4  On 
average,  each  of  the  64  regional  financial  analysts  is  now  responsible  for 
reviewing  almost  $1.9  billion  in  federal  Medicaid  expenditures  each  fiscal 
year  as  compared  to  an  average  of  about  $0.7  billion  a  decade  ago. 

In  light  of  these  conditions,  CMS  managers  acknowledged  that  they 
needed  to  revise  their  oversight  approach  and  in  April  2001,  began  to 
develop  a  risk-based  approach  for  determining  how  best  to  deploy  CMS 
resources  in  reviewing  Medicaid  expenditures. 

This  new  assessment  effort  required  each  regional  office  to  provide  data 
on  the  states  and  territories  in  its  jurisdiction  based  on  regional  analyst 
experience  and  knowledge.  For  each  type  of  Medicaid  service  and 
administrative  expense,  the  Medicaid  risk  analysis  estimates  the  likelihood 
and  significance  of  risk  based  on  dollars  expended  annually  and  measures 
risk  based  on  factors  such  as  unclear  payment  policies;  state  payments 
involving  county  and  local  government;  and  federal  audit  results.  The  risk 


3In  some  instances,  these  findings  were  included  in  the  management  letters  that 
accompanied  the  audited  financial  statements  for  fiscal  years  2000,  1999,  and  1998. 

4The  $120  billion  in  expenditures  in  2000  is  equal  to  $97.8  billion  in  1992  dollars  when 
adjusted  for  inflation. 
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analysis  provides  a  score  for  each  state  that  is  intended  to  specify  the 
areas  of  greatest  risk  for  improper  payments. 

Medicaid  financial  managers  also  tabulated  a  national  risk  score  for  each 
type  of  Medicaid  service  and  administrative  expense  using  the  state  risk 
scores.  However,  at  the  time  of  our  review,  CMS  had  not  taken  steps  to 
use  the  risk  analysis  in  deploying  its  regional  financial  oversight  resources. 
Medicaid  financial  managers  in  headquarters  and  the  regional  offices  plan 
to  develop  work  plans  that  will  allocate  resources  based  on  the  risks 
identified  from  the  analysis.  CMS  expects  to  implement  these  work  plans 
in  reviewing  the  state’s  quarterly  expenditure  reports  for  fiscal  year  2003. 

In  evaluating  the  Medicaid  risk  analysis,  we  considered  strategies  that 
leading  organizations  used  in  successfully  implementing  risk  management 
processes.  Our  executive  guide,  Strategies  to  Manage  Improper 
Payments 5  included  two  risk  assessment  strategies  that  are  particularly 
applicable  to  CMS.  These  are  that  management  should 

•  use  information  developed  from  risk  assessments  to  form  the  basis  from 
which  it  determines  the  nature  of  any  corrective  actions,  and  to  provide 
baseline  data  for  measuring  progress  in  reducing  payment  inaccuracies 
and  other  errors;  and 

•  reassess  risks  regularly  to  evaluate  the  effect  of  changing  conditions,  both 
internal  and  external,  on  program  operations. 

While  the  Medicaid  risk  analysis  is  a  good  start,  we  identified  several 
improvements  that  should  be  made  to  the  assessment  before  it  is  used  to 
deploy  resources.  First,  the  analysis  does  not  sufficiently  take  into  account 
state  financial  oversight  activities  in  assessing  the  risks  for  improper 
payments  in  each  state.  Several  states  have  implemented  techniques  such 
as  (1)  prepayment  edits  and  reviews  to  help  prevent  improper  payments, 
(2)  screening  procedures  to  prevent  dishonest  providers  from  entering  the 
Medicaid  program,  (3)  postpayment  reviews  to  detect  inappropriate 
payments  after  the  fact,  and  (4)  payment  accuracy  studies  to  measure  the 
extent  of  improper  payments.  CMS  did  not  ask  the  regional  financial 
analysts  to  consider  whether  states  use  these  techniques,  which  have 
identified  millions  of  dollars  in  overpayments.  While  regional  financial 


5U.S.  General  Accounting  Office,  Strategies  to  Manage  Improper  Payments:  Learning 
From  Public  and  Private  Sector  Organizations,  GAO-02-69G  (Washington  D.C.:  Oct.  1, 
2001). 
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analysts  may  know  about  many  activities  like  these  through  their  oversight 
responsibilities,  without  collecting  and  documenting  this  information, 

CMS  does  not  have  a  complete  picture  of  the  risk  for  improper  payments 
in  each  state;  nor  will  it  have  comprehensive  information  to  determine  the 
appropriate  level  of  federal  oversight  that  should  be  applied. 

A  second  deficiency  we  found  in  the  Medicaid  risk  analysis  is  that  it  did 
not  specifically  integrate  information  about  state  anti-fraud  and  -abuse 
efforts  in  assessing  risks  for  each  state.  Regional  financial  analysts  were 
instructed  to  consider  the  last  time  the  regional  office  or  HHS/OIG 
conducted  a  review  or  audit  as  one  of  the  factors  in  determining  the 
likelihood  and  significance  of  risk  in  each  state.  However,  the  analysts 
were  not  specifically  instructed  to  consider  results  from  reviews  of  state 
anti-fraud  and  -abuse  efforts  recently  conducted  by  the  CMS  Medicaid 
Alliance  for  Program  Safeguards,  which  has  performed  structured  reviews 
in  16  states  and  plans  to  continue  the  reviews  until  all  states  are  covered. 
CMS  could  gain  valuable  information  for  more  accurately  assessing  the 
level  of  risk  for  improper  payments  in  these  16  states  as  well  as  the 
appropriate  level  of  federal  oversight  required. 

Third,  we  found  that  the  Medicaid  risk  analysis  did  not  include 
mechanisms  to  ensure  that  such  analysis  would  be  an  ongoing  part  of 
financial  oversight.  As  identified  risks  are  addressed  and  control  activities 
are  changed,  agency  managers  should  have  methods  in  place  to  revisit 
their  analysis  to  determine  where  risks  have  decreased  and  new  ones  have 
emerged.  Medicaid  financial  managers  had  not  determined  how  they 
would  accomplish  this. 

Finally,  the  Medicaid  risk  analysis  would  be  strengthened  if  states  were 
systematically  estimating  the  level  of  improper  payments  in  their 
programs.  CMS  management  has  recognized  this  and  has  begun  efforts  to 
develop  an  approach  for  estimating  improper  Medicaid  payments.  In 
September  2001,  nine  states  responded  to  a  CMS  solicitation  to  participate 
in  pilot  studies  to  develop  payment  accuracy  measurement  methodologies. 
The  objective  is  to  assess  whether  it  is  feasible  to  develop  a  single 
methodology  for  the  diverse  state  Medicaid  programs  and  to  explore 
whether  the  range  of  improper  Medicaid  payments  can  be  estimated 
nationally.  Each  of  the  nine  states  involved  is  developing  a  different 
measurement  methodology.  CMS  managers  expect  the  states  to  complete 
the  pilots  during  fiscal  year  2003,  after  which  time  CMS  will  select  several 
of  the  state  methodologies  as  test  cases  for  fiscal  year  2004.  It  is  important 
that  CMS  continues  to  emphasize  development  of  these  payment  accuracy 
reviews  on  a  state-by-state  basis  and  ultimately  on  a  national  level,  since 
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this  is  a  key  baseline  measure  for  managing  improper  payments  in  the 
Medicaid  program. 


Control  Activities 
Were  Not  Effectively 
Implemented 


Our  review  also  found  that  while  CMS  had  certain  control  activities  in 
place  to  oversee  Medicaid  programs,  it  was  not  effectively  implementing 
them,  and  therefore  not  mitigating  identified  risks.  Control  activities  are  an 
integral  part  of  an  organization’s  efforts  to  address  risks  that  lead  to  fraud 
and  abuse.  Given  the  current  level  of  resources  and  the  size  and 
complexity  of  the  Medicaid  program,  CMS  needs  a  different  approach  that 
incorporates  new  oversight  techniques  and  strategies  as  well  as  the  results 
of  the  risk  assessment  discussed  previously. 


In  1994,  CMS  began  changing  its  oversight  approach  in  an  attempt  to 
address  resource  challenges  and  growth  in  Medicaid  expenditures.  At  that 
time,  regional  offices  shifted  from  emphasizing  detailed  review  of 
Medicaid  expenditure  data  to  increasing  the  level  of  technical  assistance 
provided  to  states.  Auditors  of  CMS  financial  statements  found  that  as  a 
result  of  this  shift,  regional  offices  were  not  providing  appropriate  review 
and  oversight  of  state  Medicaid  programs,  thus  increasing  the  risk  that 
errors  and  misappropriation  could  occur  and  go  undetected.  In  our  review, 
we  found  that  the  weaknesses  identified  by  the  auditors  were  still  present. 


In  August  2001,  we  surveyed  regional  financial  analysts  to  obtain  their 
perspectives  on  the  design  and  implementation  of  the  Medicaid  financial 
oversight  process,  covering  the  period  from  October  1,  1999,  through  the 
date  of  the  survey.  In  comments  to  the  survey,  some  regional  analysts 
indicated  that  they  were  inundated  with  responsibility  for  multiple  control 
activities  and  unable  to  perform  them  effectively.  We  asked  the  analysts  to 
rate  each  of  the  control  activities  that  they  perform.  The  activity  rated 
most  important  by  89  percent  of  those  surveyed  was  quarterly  expenditure 
reviews  performed  on-site  at  state  Medicaid  agencies.  However,  when 
asked  about  the  adequacy  with  which  they  performed  on-site  expenditure 
reviews,  almost  36  percent  rated  their  performance  “inadequate”  or 
“marginal.”  In  discussions,  many  financial  analysts  attributed  deficiencies 
in  expenditure  reviews  to  inadequate  staff  resources,  the  low  priority 
placed  on  financial  management  oversight,  lack  of  training,  and  conflicting 
priorities. 
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Survey  respondents  also  rated  two  other  activities  as  important  in 
overseeing  the  propriety  of  Medicaid  activities — these  were  activities  to 
(1)  defer  and  disallow6  Medicaid  expenditures  and  (2)  perform  focused 
financial  management  reviews.  While  more  than  75  percent  of  analysts 
rated  these  activities  as  highly  important,  data  provided  by  CMS  indicate, 
however,  that  the  amount  of  Medicaid  expenditures  disallowed  by  regional 
analysts  has  declined.  For  example,  from  1990  to  1993,  analysts  disallowed 
on  average  $2397  million  in  expenditures  annually.  However,  for  fiscal 
years  1997  through  2000,  analysts  disallowed  on  average  $43  million 
annually,  which  represents  an  82  percent  decline.  During  the  same  period, 
Medicaid  expenditures  went  from  an  average  of  $58  billion  annually  to 
$106  billion  annually — an  increase  of  83  percent.8 

Similarly,  focused  financial  management  reviews  declined.  These  reviews 
generally  involve  selecting  a  sample  of  paid  claims  related  to  certain  types 
of  Medicaid  services  provided.  The  reviews  have  been  useful  in  identifying 
unallowable  costs  outside  of  those  detected  by  reviewing  quarterly 
expenditure  reports.  According  to  CMS  managers,  in  fiscal  year  1992, 
analysts  performed  about  90  in-depth  reviews  of  specific  Medicaid  issues 
that  identified  approximately  $216  million  in  unallowable  Medicaid  costs. 
In  fiscal  year  2000,  analysts  only  performed  8  focused  financial 
management  reviews  but  these  8  reviews  resulted  in  almost  $45  million  in 
disallowed  costs — an  average  of  about  $5.6  million  per  review.  As 
demonstrated,  this  control  activity  is  effective  in  detecting  unallowable 
Medicaid  costs;  however,  it  must  be  consistently  performed  for  cost 
savings  to  be  realized. 

CMS  is  taking  actions  to  improve  oversight  by  beginning  a  comprehensive 
assessment  of  its  Medicaid  oversight  activities.  However,  agency  managers 
are  concerned  that  their  ability  to  address  identified  risks  effectively  may 
be  hindered  without  additional  oversight  resources.  In  the  interim,  CMS 
plans  to  use  the  current  oversight  process  (i.e.,  quarterly  expenditure 


6A  deferral  is  an  action  taken  to  withhold  funds  from  the  states  until  additional  clarification 
or  documentation  is  received  from  the  states  regarding  Medicaid  costs  claimed.  A 
disallowance  is  a  determination  by  CMS  that  a  claim  or  portion  of  a  claim  by  a  state  for 
federal  funds  is  unallowable. 

'The  calculation  of  this  amount  does  not  include  $1.15  billion  in  disallowances  of  Medicaid 
amounts  for  Disproportionate  Share  Hospital  (DSH)  claims  in  FY  ‘92  that  resulted  from  a 
change  in  the  legislation  related  to  DSH.  Including  this  amount  would  increase  the  average 
disallowance  to  $527  million  for  FY  ‘90  -  ‘93. 

Expenditure  and  disallowance  data  provided  by  CMS. 
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reviews  and  technical  assistance)  for  targeting  those  Medicaid  issues  that 
the  new  risk  analysis  identifies. 

In  assessing  what  steps  CMS  could  take  to  more  efficiently  and  effectively 
carry  out  its  responsibilities  to  help  ensure  the  propriety  of  Medicaid 
finances,  we  considered  strategies  that  other  organizations  have  used  in 
successfully  addressing  risks  that  lead  to  fraud,  error,  or  improper 
payments.  As  discussed  in  our  executive  guide  on  Strategies  to  Manage 
Improper  Payments,  key  strategies  include 

•  selecting  appropriate  control  activities  based  on  an  analysis  of  the  specific 
risks  facing  the  organization,  taking  into  consideration  the  nature  of  the 
organization  and  the  environment  in  which  it  operates. 

•  performing  a  cost-benefit  analysis  of  potential  control  activities  before 
implementation  to  ensure  the  cost  of  the  activities  is  not  greater  than  the 
benefit. 

•  contracting  activities  out  to  firms  that  specialize  in  specific  areas  like 
neural  networking,  where  in-house  expertise  is  not  available. 

Our  executive  guide  points  out  that  many  organizations  have  implemented 
control  techniques  including  data  mining,  data  sharing,  and  neural 
networking  to  address  identified  risk  areas  and  help  ensure  that  program 
objectives  are  met. 

•  Data  mining  is  a  technique  in  which  relationships  among  data  are  analyzed 
to  discover  new  patterns,  associations,  or  sequences.  Using  data  mining 
software,  the  Illinois  Department  of  Public  Aid,  in  partnership  with  the 
Office  of  Inspector  General  at  the  Department  of  Health  and  Human 
Services,  identified  232  hospital  transfers  that  may  have  been  miscoded  as 
discharges,  creating  a  potential  overpayment  of  $1.7  million. 

•  Data  sharing  allows  entities  to  compare  information  from  different 
sources  to  help  ensure  that  Medicaid  expenditures  are  appropriate.  Last 
year  we  reported  on  a  data  sharing  project  called  the  Public  Assistance 
Reporting  Information  System  (PARIS)  that  has  identified  millions  of 
dollars  in  costs  savings  for  states.9  PARIS  helps  states  share  information 
on  public  assistance  programs,  in  order  to  identify  individuals  who  may  be 
receiving  benefits  in  more  than  one  state  simultaneously.  Using  the  PARIS 
data  match  for  the  first  time  in  1997,  Maryland  identified  numerous 


9U.S.  General  Accounting  Office,  Public  Assistance:  PARIS  Project  Can  Help  States  Reduce 
Improper  Benefit  Payments,  GAO-Ol-935  (Washington,  D.C.:  Sept.  6,  2001) 
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individuals  who  no  longer  lived  in  the  state  but  for  whom  the  state  was 
continuing  to  pay  a  Medicaid  managed  care  organization.  The  match 
identified  $7.3  million  in  savings  for  the  Medicaid  program. 

•  Neural  networking  is  a  technique  used  to  extract  and  analyze  data.  A 
neural  network  is  intended  to  simulate  the  way  a  brain  processes 
information,  learns,  and  remembers.  This  technique  can  help  identify  fraud 
schemes  by  analyzing  utilization  trends,  patterns,  and  complex 
interrelationships  in  the  data.  In  1997,  the  Texas  legislature  mandated  the 
use  of  neural  networks  in  the  Medicaid  program.  In  fiscal  year  2000,  using 
neural  networking,  the  Texas’  Medicaid  Fraud  and  Abuse  Detection 
System  recovered  $3.4  million. 

These  techniques,  which  have  been  shown  to  achieve  significant  savings 
by  identifying  and  detecting  improper  payments,  could  help  CMS  better 
utilize  its  limited  resources  in  applying  effective  oversight  of  Medicaid 
finances  at  the  federal  level. 

Some  state  Medicaid  agencies  have  already  implemented  data  mining,  data 
sharing,  and  neural  networking  techniques  to  help  ensure  Medicaid 
program  integrity.  State  auditors  and  HHS/OIG  staff  have  also  had  success 
using  these  techniques  in  overseeing  state  Medicaid  programs.  However, 
resources  devoted  to  protecting  Medicaid  program  integrity  and  the  use  of 
these  techniques  varies  significantly  state  by  state.  When  designing  its 
Medicaid  financial  oversight  control  activities,  CMS  should  take  into 
consideration  the  use  of  data  mining,  data  sharing,  and  neural  networking 
as  well  as  other  control  activities  performed  at  the  state  level.  In  states 
where  these  techniques  are  not  being  used,  CMS  should  consider  using 
these  tools  in  its  oversight  process. 


Monitoring  Activities 
Were  Limited  in  Scope 
and  Effectiveness 


The  Comptroller  General’s  Standards  for  Internal  Control  in  the  Federal 
Government  requires  that  agency  managers  implement  monitoring 
activities  to  continuously  assess  the  effectiveness  of  control  activities  put 
in  place  to  address  identified  risks.  Our  review  found  that  CMS  had  few 
mechanisms  in  place  to  continuously  monitor  the  effectiveness  of  its 
oversight.  Managers  had  not  established  performance  standards  for 
financial  oversight  activities,  particularly  their  expenditure  review  activity. 
Limited  data  were  collected  to  assess  regional  financial  analyst 
performance  in  overseeing  state  Medicaid  programs.  Without  effective 
monitoring,  CMS  did  not  have  the  information  needed  to  help  assure  the 
propriety  of  Medicaid  expenditures. 
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A  CMS  official  told  us  that  steps  would  be  taken  within  the  next  year  to 
begin  monitoring  the  effectiveness  of  the  Medicaid  financial  oversight 
process.  Medicaid  financial  managers  plan  to  reinstitute  a  performance 
reporting  process  that  was  in  place  prior  to  1993.  While  this  is  a  good  step, 
the  previous  process  lacked  several  elements  necessary  for  effective 
internal  control  monitoring.  For  example,  the  performance  reporting 
process  did  not  establish  agency-specific  goals  and  measures  for 
evaluating  regional  performance  in  reducing  payment  errors  and 
inaccuracies.  In  addition,  there  were  no  formal  criteria  or  standard 
estimation  methodologies  for  regions  to  use  in  measuring  the  amount  of 
unallowable  costs  that  the  states  avoided  because  of  technical  assistance 
provided  before  payment.  As  discussed  in  our  executive  guide,  Strategies 
to  Manage  Improper  Payments,  establishing  such  goals  and  measures  is 
key  to  tracking  the  success  of  improvement  initiatives. 

In  addition,  the  CMS  audit  resolution  procedures  did  not  collect  sufficient 
information  on  the  status  of  audit  findings  or  ensure  their  timely 
resolution,  as  required  by  federal  internal  control  standards.  We  found  that 
audit  resolution  and  monitoring  activities  performed  by  CMS  and  its 
regional  offices  were  limited.  Audit  resolution  activities  were  also 
inconsistently  performed  across  the  regions. 

Within  CMS,  three  units  share  responsibility  for  audit  resolution  activities 
related  to  the  Medicaid  program.  In  accordance  with  the  HHS  Grants 
Administration  Manual,10  regional  financial  analysts  are  responsible  for 
working  with  auditors  to  resolve  findings,  ensure  questioned  costs  are 
recovered,  verify  that  corrective  actions  have  been  taken,  and  document 
the  status  of  audit  resolution  in  quarterly  reports.  The  Division  of  Audit 
Liaison  (DAL)  is  responsible  for  maintaining  a  tracking  system  for  each 
audit  report  and  related  findings,  monitoring  the  timeliness  and  adequacy 
of  audit  resolution  activities,  distributing  all  audit  clearance  documents, 
and  preparing  monthly  reports  on  the  status  of  audit  resolution  and 
collection  activities.  The  Division  of  Financial  Management  (DFM),  the 
headquarters  unit  responsible  for  Medicaid  financial  management,  has  one 
headquarters  staff  person  responsible  for  coordinating  and  interacting 
with  DAL  and  regional  analysts  to  ensure  that  Medicaid  related  findings 


10The  Grants  Administration  Manual,  issued  by  HHS,  provides  guidance  on  implementing 
HHS  policies  on  the  administration  of  HHS  grants.  Chapter  1-105  of  the  manual  addresses 
the  resolution  of  audit  findings. 
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are  resolved.  We  found  that  many  of  these  responsibilities  were  not  being 
effectively  carried  out  or  were  carried  out  inconsistently. 

For  instance,  in  discussions  with  regional  financial  analysts,  we  found  that 
they  spend  very  little  time  resolving  state  single  audit  findings  due  to 
competing  oversight  responsibilities.  As  a  result,  these  findings  are  not 
always  resolved,  and  related  questioned  costs  are  not  promptly  recovered. 
We  found  unrecovered  questioned  costs  totaling  $24  million  that  were 
identified  in  audit  reports  that  had  been  issued  for  years  prior  to  fiscal 
year  1999.  In  addition,  we  found  that  as  of  September  30,  2001,  regional 
analysts  had  not  determined  whether  actions  had  been  taken  to  resolve  85 
Medicaid  findings  included  in  state  single  audit  reports  for  fiscal  year  1999. 
Lack  of  timely  follow-up  on  financial  management  and  internal  control 
issues  increases  the  risk  that  corrective  actions  may  not  have  been  taken, 
and  that  erroneous  or  improper  payments  are  continuing  to  be  made. 

We  also  found  that  the  regional  financial  analysts  inconsistently  followed 
procedures  for  monitoring,  tracking,  and  reporting  on  the  resolution  of 
single  audit  and  HHS/OIG  audit  findings.  For  example,  3  of  the  10  regions 
had  not  prepared  quarterly  status  reports  that  are  intended  to  provide 
information  on  corrective  actions  that  states  have  taken  to  resolve  audit 
findings. 

Further,  pertinent  information  was  not  identified,  documented,  and 
distributed  among  those  responsible  for  audit  resolution.  The  internal 
control  standard  related  to  information  and  communication  provides  that 
pertinent  information  be  identified,  recorded,  and  distributed  to  the 
appropriate  areas  in  sufficient  detail,  and  at  the  appropriate  time  to  enable 
the  entity  to  carry  out  its  duties  and  responsibilities  efficiently  and 
effectively.  In  our  review,  we  found  that  the  monthly  DAL  report  intended 
to  provide  a  complete  list  of  all  audits  with  unresolved  Medicaid  findings 
did  not  meet  this  standard.  We  analyzed  a  list  provided  by  the  HHS/OIG 
that  included  23  Medicaid  related  reports  issued  by  the  HHS/OIG  and  state 
auditors  in  fiscal  year  2001.  We  found  four  reports  from  the  HHS/OIG  list 
that  were  not  included  in  DAL  monthly  reports  related  to  the  second, 
third,  and  fourth  quarters  of  that  year.  This  information  is  critical  and  must 
be  distributed  to  the  regions  to  ensure  that  they  are  acting  to  resolve  all 
Medicaid  related  findings. 

We  also  found  that  the  regions  did  not  document  information  critical  to 
tracking  unresolved  audits  in  their  regional  quarterly  status  reports.  The 
regions  reported  which  audits  had  been  resolved  but  not  the  status  of 
those  still  under  review.  This  makes  it  difficult  to  track  audit  status. 
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Organizational 
Structure  Impedes 
Effective  Oversight 


The  current  organizational  structure  of  CMS  compounds  the  weaknesses  I 
have  highlighted  today.  This  organizational  structure  has  created 
challenges  to  effective  oversight  because  of  unclear  lines  of  authority  and 
responsibility  between  the  regions  and  headquarters.  Although  the  10 
regional  offices  are  the  CMS  front  line  in  overseeing  state  financial 
management  and  Medicaid  expenditures,  there  are  no  reporting 
relationships  to  DFM,  the  headquarters  unit  responsible  for  Medicaid 
financial  management. 

For  example,  a  working  group  headed  by  the  director  of  DFM  updated 
guidance  for  expenditure  reviews  in  September  2000  in  response  to 
concerns  raised  by  auditors  about  the  inconsistency  in  expenditure 
reviews  across  regions.  While  the  guide  strongly  encouraged  regional 
analysts  to  perform  all  procedures,  it  did  not  mandate  that  they  do  so. 
Headquarters  financial  managers  do  not  have  direct  authority  to  enforce 
such  a  directive  and  regional  managers  have  discretion  in  how  resources 
are  utilized.  Similarly,  the  guide  allowed  regional  branch  managers  the 
discretion  to  review  regional  analyst’s  expenditure  review  workpapers  for 
compliance  with  the  guide  or  simply  to  obtain  written  or  verbal  assurance 
from  the  analyst  that  the  procedures  were  performed.  By  allowing 
supervisors  to  satisfy  their  review  responsibilities  merely  with  verbal 
assurance,  CMS  minimized  the  effectiveness  of  this  basic  control.  During 
our  site  reviews,  we  found  evidence  that  supervisory  reviews  were  not 
conducted. 

The  CMS  organizational  structure  also  hindered  efforts  to  evaluate  and 
monitor  regional  office  performance.  At  the  time  of  our  review,  there  were 
few  formal  requirements  for  regions  to  report  to  headquarters  and  CMS 
did  not  collect,  analyze,  or  evaluate  consistent  information  on  the  quality 
of  regional  financial  oversight  for  Medicaid  across  the  country.  Previous 
efforts  to  monitor  performance  were  discontinued  because  regional  staff 
resources  were  not  available  to  collect  and  submit  the  data  to 
headquarters  managers.  Headquarters  managers,  in  turn,  did  not  have  the 
authority  to  require  regions  to  collect  such  data.  As  a  result,  Medicaid 
financial  managers  in  headquarters  were  not  in  a  position  to  provide 
formal  feedback  to  region  financial  management  staff  to  improve  their 
performance  and  therefore  have  not  been  in  a  position  to  assess  the 
effectiveness  of  Medicaid  oversight  activities. 

The  current  organizational  structure  also  poses  challenges  to 
implementing  corrective  actions  aimed  at  addressing  oversight 
weaknesses  and  improving  accountability.  Over  the  past  2  years, 
headquarters  financial  managers  have  taken  steps  to  develop  and 
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implement  improvements  to  the  financial  oversight  process.  Medicaid  staff 
are  currently 

•  developing  risk  analysis  to  identify  expenditures  of  greatest  risk; 

•  working  with  states  to  develop  methodologies  for  estimating  Medicaid 
improper  payments; 

•  developing  work  plans  that  guide  efforts  to  allocate  financial  oversight 
staff  and  travel  resources  based  on  the  risk  analysis;  and 

•  developing  performance-reporting  mechanisms. 

Medicaid  staff  have  also  recently 

•  formed  a  financial  management  strategy  workgroup  of  headquarters  and 
regional  financial  management  staff  to  review  the  entire  Medicaid  financial 
oversight  process  and  determine  the  proper  structure  for  an  adequate 
oversight  process; 

•  updated  its  expenditure  and  budget  review  guides;  and 

•  gathered  information  on  how  regional  financial  analyst  staff  time  is 
allocated  between  oversight  responsibilities. 

Headquarters  DFM  managers  recognize  that  regional  office  commitment  is 
critical  to  successfully  implementing  and  sustaining  its  improvement 
initiatives.  The  current  structural  relationship  could  diminish  the  chances 
of  such  success.  Headquarters  managers  expressed  concern  that  despite 
recent  efforts  to  develop  risk  analysis  and  implement  work  plans  that 
allocate  resources  based  on  identified  risks,  regional  managers  will  still 
have  the  authority  to  decide  how  oversight  resources  are  utilized.  Given 
the  multiple  oversight  activities  that  regional  financial  analysts  are 
responsible  for,  headquarters  managers  have  no  assurance  that  review 
areas  included  in  the  work  plans  will  be  given  priority  in  each  region. 
Headquarters  managers  may  experience  similar  difficulties  in 
reestablishing  performance  reporting.  According  to  one  senior  Medicaid 
manager,  some  regions  have  already  petitioned  headquarters  managers  not 
to  use  data  on  the  amount  of  expenditures  deferred  and  disallowed  in 
gauging  performance. 

During  our  review,  we  asked  regional  financial  analysts  about  several 
recent  improvement  initiatives  to  gauge  their  knowledge  and  participation 
in  the  initiatives.  Several  analysts  we  spoke  with  did  not  think  the  risk 
assessment  effort  was  useful  because  they  felt  that  they  already  knew  the 
risks  within  the  states  that  they  were  responsible  for  and  did  not  need  a 
formal  assessment  to  tell  them  that.  In  our  survey,  we  asked  regional 
financial  analysts  to  rate  the  importance  of  the  risk  assessment,  staff  time 
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allocation  effort,  and  review  guide  updates  to  overall  financial  oversight. 
Approximately  half  of  the  survey  respondents  thought  the  initiatives  were 
of  marginal  or  little  importance.  During  pretests  of  our  survey,  several 
analysts  said  they  did  not  understand  the  purpose  of  the  initiatives 
because  no  one  had  communicated  to  them  how  the  information  was 
going  to  be  used. 

In  discussions  with  headquarters  managers,  they  acknowledged  that  a 
written  plan  or  strategy  that  describes  the  initiatives  and  the  responsibility 
for  implementing  them  was  still  being  drafted.  Such  a  plan  or  strategy 
could  be  very  useful  in  soliciting  regional  analyst  support.  More 
importantly,  headquarters  managers  acknowledged  that  performance 
accountability  mechanisms  for  the  regions  are  needed  to  implement 
improvements  successfully.  CMS  is  currently  planning  some  changes  that 
may  improve  mechanisms  to  hold  CMS  financial  managers,  including 
regional  managers  and  administrators,  accountable  for  critical  tasks.  CMS 
has  developed  a  restructuring  and  management  plan  that  seeks  to  add 
specific  responsibilities  tied  to  agency  goals  into  senior  managers’ 
performance  agreements.  CMS  has  not  determined  how  Medicaid  financial 
management  oversight  responsibilities  that  can  be  evaluated  will  be 
included  in  the  plan.  This  information  is  key  to  establishing  a  sound 
internal  control  environment  for  Medicaid  finances  throughout  CMS. 

As  you  can  see,  this  structural  relationship  has  created  challenges  in 
(1)  establishing  and  enforcing  minimum  standards  for  performing  financial 
oversight  activities,  (2)  routinely  evaluating  the  regional  office  oversight, 
and  (3)  implementing  efforts  to  improve  financial  oversight.  As  a  result, 
CMS  lacks  a  consistent  approach  to  monitor  and  improve  performance 
among  the  units  that  share  responsibility  for  financial  management  and 
ingrain  a  sound  internal  control  environment  for  Medicaid  finances 
throughout  CMS. 


In  closing,  Mr.  Chairman,  I  want  to  emphasize  that  while  CMS  is  acting  to 
improve  its  financial  oversight  of  the  Medicaid  program,  the  increasing 
size  and  complexity  of  the  program,  coupled  with  diminishing  oversight 
resources,  requires  a  new  approach  to  address  these  challenges. 
Developing  baseline  information  on  Medicaid  issues  at  greatest  risk  for 
improper  payments  and  measuring  improvements  in  program  management 
against  that  baseline  is  key  to  achieving  effective  financial  oversight. 
Determining  the  level  of  state  activities  in  place  to  monitor  and  control 
Medicaid  finances  is  also  critical  to  determining  the  extent  and  type  of 
control  techniques  as  well  as  the  amount  of  resources  CMS  must  apply  at 
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the  federal  level  to  oversee  the  program  adequately.  Establishing  clear 
lines  of  authority  and  performance  standards  for  CMS  oversight  would 
also  provide  for  a  more  efficient,  effective,  and  accountable  Medicaid 
program.  Our  report  includes  recommendations  in  each  of  these  areas. 
CMS’s  ability  to  make  the  kind  of  changes  that  we  are  recommending  will 
require  top-level  management  commitment,  a  comprehensive  financial 
oversight  strategy  that  is  clearly  communicated  to  all  those  responsible  for 
program  oversight,  and  clear  expectations  for  implementation  of  the 
changes. 

Mr.  Chairman,  this  concludes  my  statement.  I  would  be  happy  to  answer 
any  questions  you  or  other  members  of  the  subcommittee  may  have. 
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